Malicious PDF — malware analysis report

Heuristics 5

• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
  Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://cctraff.ru/strik?keyword=bakery+panama+city+beach In PDF document text

  • https://cdn-cms.f-static.net/uploads/4371524/normal_5f8a14760791b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4373527/normal_5f8a0bf0a90f0.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4374024/normal_5f8969b8cc65b.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368219/normal_5f87c3482e6cf.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4372721/normal_5f895c4983105.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368475/normal_5f886341d0479.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368219/normal_5f889466d979f.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4366664/normal_5f89a5f018847.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369903/normal_5f8a0e1431443.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365601/normal_5f872e4dce418.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4365560/normal_5f873ef0dcfcb.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4369643/normal_5f87eb39b950e.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367281/normal_5f87a3a1364a5.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4367952/normal_5f875cf256ee9.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://uploads.strikinglycdn.com/files/c833a82c-27e2-4d5d-9f69-c801148fc2f1/49151680649.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/2a6b9594-211f-4d6c-85eb-d41577b02ce2/nojurevutukelesiratudaj.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/ad28e54c-ea8b-4985-9792-cde539d6b208/rebigelinon.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f1ea0a0f-5acb-45ea-849e-44b12f550959/93397421884.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/12aae212-0bf5-478d-b2ef-fe31d5c22e80/fusimugejoxezivanivu.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0480/4693/2132/files/kindred_octavia_butler_online_free.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0439/1452/6872/files/kakapadimon.pdfIn PDF document text
  • https://cdn.shopify.com/s/files/1/0502/0647/4420/files/fluoride_application_guidelines_uk.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/875c2a58-a040-4631-aa8a-16ee79907fa2/47121230534.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/9505d86b-24dd-4a73-80d9-55bd5c6f9de9/gikotubetebugo.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f6f2e788-0fbf-492d-a7ee-5611fbc21d18/xoran.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/07ed5da5-12d6-466f-a3dc-aca88a0d11b3/katy_perry_cozy_little_christmas.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.